Flask Session Cookie Vulnerability in Man-Group dtale Affects Security
CVE-2026-19896

6.3MEDIUM

Key Information:

Vendor

Mangroup

Status
Dtale
Vendor
CVE Published:
15 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-19896?

A vulnerability in the Man-Group dtale product affects the function responsible for generating cryptographic keys, specifically within the Flask Session Cookie implementation. This flaw leads to insufficiently random values, which could be exploited remotely, making the system susceptible to various types of attacks. While the complexity of the exploit is noted as high, successful execution remains challenging. The vulnerability has been publicly acknowledged, and a fix is pending approval as part of ongoing efforts to enhance security within the affected application.

Affected Version(s)

dtale 3.0

dtale 3.1

dtale 3.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-19896 - Proof of Concept

References

https://vuldb.com/vuln/390086
vdb-entrytechnical-description
https://vuldb.com/vuln/390086/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-19896
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

ZAST.AI (VulDB User)
VulDB CNA Team
.